1 /* 2 * Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26 package sun.security.provider; 27 28 import java.io.*; 29 import java.net.MalformedURLException; 30 import java.net.URI; 31 import java.net.URL; 32 import java.security.AccessController; 33 import java.security.PrivilegedAction; 34 import java.security.PrivilegedActionException; 35 import java.security.PrivilegedExceptionAction; 36 import java.security.Security; 37 import java.security.URIParameter; 38 import java.text.MessageFormat; 39 import java.util.*; 40 import javax.security.auth.AuthPermission; 41 import javax.security.auth.login.AppConfigurationEntry; 42 import javax.security.auth.login.AppConfigurationEntry.LoginModuleControlFlag; 43 import javax.security.auth.login.Configuration; 44 import javax.security.auth.login.ConfigurationSpi; 45 import sun.security.util.Debug; 46 import sun.security.util.PropertyExpander; 47 import sun.security.util.ResourcesMgr; 48 49 /** 50 * This class represents a default implementation for 51 * {@code javax.security.auth.login.Configuration}. 52 * 53 * <p> This object stores the runtime login configuration representation, 54 * and is the amalgamation of multiple static login configurations that 55 * resides in files. The algorithm for locating the login configuration 56 * file(s) and reading their information into this {@code Configuration} 57 * object is: 58 * 59 * <ol> 60 * <li> 61 * Loop through the security properties, 62 * <i>login.config.url.1</i>, <i>login.config.url.2</i>, ..., 63 * <i>login.config.url.X</i>. 64 * Each property value specifies a {@code URL} pointing to a 65 * login configuration file to be loaded. Read in and load 66 * each configuration. 67 * 68 * <li> 69 * The {@code java.lang.System} property 70 * <i>java.security.auth.login.config</i> 71 * may also be set to a {@code URL} pointing to another 72 * login configuration file 73 * (which is the case when a user uses the -D switch at runtime). 74 * If this property is defined, and its use is allowed by the 75 * security property file (the Security property, 76 * <i>policy.allowSystemProperty</i> is set to <i>true</i>), 77 * also load that login configuration. 78 * 79 * <li> 80 * If the <i>java.security.auth.login.config</i> property is defined using 81 * "==" (rather than "="), then ignore all other specified 82 * login configurations and only load this configuration. 83 * 84 * <li> 85 * If no system or security properties were set, try to read from the file, 86 * ${user.home}/.java.login.config, where ${user.home} is the value 87 * represented by the "user.home" System property. 88 * </ol> 89 * 90 * <p> The configuration syntax supported by this implementation 91 * is exactly that syntax specified in the 92 * {@code javax.security.auth.login.Configuration} class. 93 * 94 * @see javax.security.auth.login.LoginContext 95 * @see java.security.Security security properties 96 */ 97 public final class ConfigFile extends Configuration { 98 99 private final Spi spi; 100 101 public ConfigFile() { 102 spi = new Spi(); 103 } 104 105 @Override 106 public AppConfigurationEntry[] getAppConfigurationEntry(String appName) { 107 return spi.engineGetAppConfigurationEntry(appName); 108 } 109 110 @Override 111 public synchronized void refresh() { 112 spi.engineRefresh(); 113 } 114 115 public static final class Spi extends ConfigurationSpi { 116 117 private URL url; 118 private boolean expandProp = true; 119 private Map<String, List<AppConfigurationEntry>> configuration; 120 private int linenum; 121 private StreamTokenizer st; 122 private int lookahead; 123 124 private static Debug debugConfig = Debug.getInstance("configfile"); 125 private static Debug debugParser = Debug.getInstance("configparser"); 126 127 /** 128 * Creates a new {@code ConfigurationSpi} object. 129 * 130 * @throws SecurityException if the {@code ConfigurationSpi} can not be 131 * initialized 132 */ 133 public Spi() { 134 try { 135 init(); 136 } catch (IOException ioe) { 137 throw new SecurityException(ioe); 138 } 139 } 140 141 /** 142 * Creates a new {@code ConfigurationSpi} object from the specified 143 * {@code URI}. 144 * 145 * @param uri the {@code URI} 146 * @throws SecurityException if the {@code ConfigurationSpi} can not be 147 * initialized 148 * @throws NullPointerException if {@code uri} is null 149 */ 150 public Spi(URI uri) { 151 // only load config from the specified URI 152 try { 153 url = uri.toURL(); 154 init(); 155 } catch (IOException ioe) { 156 throw new SecurityException(ioe); 157 } 158 } 159 160 public Spi(final Configuration.Parameters params) throws IOException { 161 162 // call in a doPrivileged 163 // 164 // we have already passed the Configuration.getInstance 165 // security check. also this class is not freely accessible 166 // (it is in the "sun" package). 167 168 try { 169 AccessController.doPrivileged(new PrivilegedExceptionAction<Void>() { 170 public Void run() throws IOException { 171 if (params == null) { 172 init(); 173 } else { 174 if (!(params instanceof URIParameter)) { 175 throw new IllegalArgumentException 176 ("Unrecognized parameter: " + params); 177 } 178 URIParameter uriParam = (URIParameter)params; 179 url = uriParam.getURI().toURL(); 180 init(); 181 } 182 return null; 183 } 184 }); 185 } catch (PrivilegedActionException pae) { 186 throw (IOException)pae.getException(); 187 } 188 189 // if init() throws some other RuntimeException, 190 // let it percolate up naturally. 191 } 192 193 /** 194 * Read and initialize the entire login Configuration from the 195 * configured URL. 196 * 197 * @throws IOException if the Configuration can not be initialized 198 * @throws SecurityException if the caller does not have permission 199 * to initialize the Configuration 200 */ 201 private void init() throws IOException { 202 203 boolean initialized = false; 204 205 // For policy.expandProperties, check if either a security or system 206 // property is set to false (old code erroneously checked the system 207 // prop so we must check both to preserve compatibility). 208 String expand = Security.getProperty("policy.expandProperties"); 209 if (expand == null) { 210 expand = System.getProperty("policy.expandProperties"); 211 } 212 if ("false".equals(expand)) { 213 expandProp = false; 214 } 215 216 // new configuration 217 Map<String, List<AppConfigurationEntry>> newConfig = new HashMap<>(); 218 219 if (url != null) { 220 /** 221 * If the caller specified a URI via Configuration.getInstance, 222 * we only read from that URI 223 */ 224 if (debugConfig != null) { 225 debugConfig.println("reading " + url); 226 } 227 init(url, newConfig); 228 configuration = newConfig; 229 return; 230 } 231 232 /** 233 * Caller did not specify URI via Configuration.getInstance. 234 * Read from URLs listed in the java.security properties file. 235 */ 236 String allowSys = Security.getProperty("policy.allowSystemProperty"); 237 238 if ("true".equalsIgnoreCase(allowSys)) { 239 String extra_config = System.getProperty 240 ("java.security.auth.login.config"); 241 if (extra_config != null) { 242 boolean overrideAll = false; 243 if (extra_config.startsWith("=")) { 244 overrideAll = true; 245 extra_config = extra_config.substring(1); 246 } 247 try { 248 extra_config = PropertyExpander.expand(extra_config); 249 } catch (PropertyExpander.ExpandException peee) { 250 throw ioException("Unable.to.properly.expand.config", 251 extra_config); 252 } 253 254 URL configURL = null; 255 try { 256 configURL = new URL(extra_config); 257 } catch (MalformedURLException mue) { 258 File configFile = new File(extra_config); 259 if (configFile.exists()) { 260 configURL = configFile.toURI().toURL(); 261 } else { 262 throw ioException( 263 "extra.config.No.such.file.or.directory.", 264 extra_config); 265 } 266 } 267 268 if (debugConfig != null) { 269 debugConfig.println("reading "+configURL); 270 } 271 init(configURL, newConfig); 272 initialized = true; 273 if (overrideAll) { 274 if (debugConfig != null) { 275 debugConfig.println("overriding other policies!"); 276 } 277 configuration = newConfig; 278 return; 279 } 280 } 281 } 282 283 int n = 1; 284 String config_url; 285 while ((config_url = Security.getProperty 286 ("login.config.url."+n)) != null) { 287 try { 288 config_url = PropertyExpander.expand 289 (config_url).replace(File.separatorChar, '/'); 290 if (debugConfig != null) { 291 debugConfig.println("\tReading config: " + config_url); 292 } 293 init(new URL(config_url), newConfig); 294 initialized = true; 295 } catch (PropertyExpander.ExpandException peee) { 296 throw ioException("Unable.to.properly.expand.config", 297 config_url); 298 } 299 n++; 300 } 301 302 if (initialized == false && n == 1 && config_url == null) { 303 304 // get the config from the user's home directory 305 if (debugConfig != null) { 306 debugConfig.println("\tReading Policy " + 307 "from ~/.java.login.config"); 308 } 309 config_url = System.getProperty("user.home"); 310 String userConfigFile = config_url + File.separatorChar + 311 ".java.login.config"; 312 313 // No longer throws an exception when there's no config file 314 // at all. Returns an empty Configuration instead. 315 if (new File(userConfigFile).exists()) { 316 init(new File(userConfigFile).toURI().toURL(), newConfig); 317 } 318 } 319 320 configuration = newConfig; 321 } 322 323 private void init(URL config, 324 Map<String, List<AppConfigurationEntry>> newConfig) 325 throws IOException { 326 327 try (InputStreamReader isr 328 = new InputStreamReader(getInputStream(config), "UTF-8")) { 329 readConfig(isr, newConfig); 330 } catch (FileNotFoundException fnfe) { 331 if (debugConfig != null) { 332 debugConfig.println(fnfe.toString()); 333 } 334 throw new IOException(ResourcesMgr.getAuthResourceString 335 ("Configuration.Error.No.such.file.or.directory")); 336 } 337 } 338 339 /** 340 * Retrieve an entry from the Configuration using an application name 341 * as an index. 342 * 343 * @param applicationName the name used to index the Configuration. 344 * @return an array of AppConfigurationEntries which correspond to 345 * the stacked configuration of LoginModules for this 346 * application, or null if this application has no configured 347 * LoginModules. 348 */ 349 @Override 350 public AppConfigurationEntry[] engineGetAppConfigurationEntry 351 (String applicationName) { 352 353 List<AppConfigurationEntry> list = null; 354 synchronized (configuration) { 355 list = configuration.get(applicationName); 356 } 357 358 if (list == null || list.size() == 0) { 359 return null; 360 } 361 362 AppConfigurationEntry[] entries = 363 new AppConfigurationEntry[list.size()]; 364 Iterator<AppConfigurationEntry> iterator = list.iterator(); 365 for (int i = 0; iterator.hasNext(); i++) { 366 AppConfigurationEntry e = iterator.next(); 367 entries[i] = new AppConfigurationEntry(e.getLoginModuleName(), 368 e.getControlFlag(), 369 e.getOptions()); 370 } 371 return entries; 372 } 373 374 /** 375 * Refresh and reload the Configuration by re-reading all of the 376 * login configurations. 377 * 378 * @throws SecurityException if the caller does not have permission 379 * to refresh the Configuration. 380 */ 381 @Override 382 public synchronized void engineRefresh() { 383 384 SecurityManager sm = System.getSecurityManager(); 385 if (sm != null) { 386 sm.checkPermission( 387 new AuthPermission("refreshLoginConfiguration")); 388 } 389 390 AccessController.doPrivileged(new PrivilegedAction<Void>() { 391 public Void run() { 392 try { 393 init(); 394 } catch (IOException ioe) { 395 throw new SecurityException(ioe.getLocalizedMessage(), 396 ioe); 397 } 398 return null; 399 } 400 }); 401 } 402 403 private void readConfig(Reader reader, 404 Map<String, List<AppConfigurationEntry>> newConfig) 405 throws IOException { 406 407 linenum = 1; 408 409 if (!(reader instanceof BufferedReader)) { 410 reader = new BufferedReader(reader); 411 } 412 413 st = new StreamTokenizer(reader); 414 st.quoteChar('"'); 415 st.wordChars('$', '$'); 416 st.wordChars('_', '_'); 417 st.wordChars('-', '-'); 418 st.wordChars('*', '*'); 419 st.lowerCaseMode(false); 420 st.slashSlashComments(true); 421 st.slashStarComments(true); 422 st.eolIsSignificant(true); 423 424 lookahead = nextToken(); 425 while (lookahead != StreamTokenizer.TT_EOF) { 426 parseLoginEntry(newConfig); 427 } 428 } 429 430 private void parseLoginEntry( 431 Map<String, List<AppConfigurationEntry>> newConfig) 432 throws IOException { 433 434 List<AppConfigurationEntry> configEntries = new LinkedList<>(); 435 436 // application name 437 String appName = st.sval; 438 lookahead = nextToken(); 439 440 if (debugParser != null) { 441 debugParser.println("\tReading next config entry: " + appName); 442 } 443 444 match("{"); 445 446 // get the modules 447 while (peek("}") == false) { 448 // get the module class name 449 String moduleClass = match("module class name"); 450 451 // controlFlag (required, optional, etc) 452 LoginModuleControlFlag controlFlag; 453 String sflag = match("controlFlag").toUpperCase(Locale.ENGLISH); 454 switch (sflag) { 455 case "REQUIRED": 456 controlFlag = LoginModuleControlFlag.REQUIRED; 457 break; 458 case "REQUISITE": 459 controlFlag = LoginModuleControlFlag.REQUISITE; 460 break; 461 case "SUFFICIENT": 462 controlFlag = LoginModuleControlFlag.SUFFICIENT; 463 break; 464 case "OPTIONAL": 465 controlFlag = LoginModuleControlFlag.OPTIONAL; 466 break; 467 default: 468 throw ioException( 469 "Configuration.Error.Invalid.control.flag.flag", 470 sflag); 471 } 472 473 // get the args 474 Map<String, String> options = new HashMap<>(); 475 while (peek(";") == false) { 476 String key = match("option key"); 477 match("="); 478 try { 479 options.put(key, expand(match("option value"))); 480 } catch (PropertyExpander.ExpandException peee) { 481 throw new IOException(peee.getLocalizedMessage()); 482 } 483 } 484 485 lookahead = nextToken(); 486 487 // create the new element 488 if (debugParser != null) { 489 debugParser.println("\t\t" + moduleClass + ", " + sflag); 490 for (String key : options.keySet()) { 491 debugParser.println("\t\t\t" + key + 492 "=" + options.get(key)); 493 } 494 } 495 configEntries.add(new AppConfigurationEntry(moduleClass, 496 controlFlag, 497 options)); 498 } 499 500 match("}"); 501 match(";"); 502 503 // add this configuration entry 504 if (newConfig.containsKey(appName)) { 505 throw ioException( 506 "Configuration.Error.Can.not.specify.multiple.entries.for.appName", 507 appName); 508 } 509 newConfig.put(appName, configEntries); 510 } 511 512 private String match(String expect) throws IOException { 513 514 String value = null; 515 516 switch(lookahead) { 517 case StreamTokenizer.TT_EOF: 518 throw ioException( 519 "Configuration.Error.expected.expect.read.end.of.file.", 520 expect); 521 522 case '"': 523 case StreamTokenizer.TT_WORD: 524 if (expect.equalsIgnoreCase("module class name") || 525 expect.equalsIgnoreCase("controlFlag") || 526 expect.equalsIgnoreCase("option key") || 527 expect.equalsIgnoreCase("option value")) { 528 value = st.sval; 529 lookahead = nextToken(); 530 } else { 531 throw ioException( 532 "Configuration.Error.Line.line.expected.expect.found.value.", 533 linenum, expect, st.sval); 534 } 535 break; 536 537 case '{': 538 if (expect.equalsIgnoreCase("{")) { 539 lookahead = nextToken(); 540 } else { 541 throw ioException( 542 "Configuration.Error.Line.line.expected.expect.", 543 linenum, expect, st.sval); 544 } 545 break; 546 547 case ';': 548 if (expect.equalsIgnoreCase(";")) { 549 lookahead = nextToken(); 550 } else { 551 throw ioException( 552 "Configuration.Error.Line.line.expected.expect.", 553 linenum, expect, st.sval); 554 } 555 break; 556 557 case '}': 558 if (expect.equalsIgnoreCase("}")) { 559 lookahead = nextToken(); 560 } else { 561 throw ioException( 562 "Configuration.Error.Line.line.expected.expect.", 563 linenum, expect, st.sval); 564 } 565 break; 566 567 case '=': 568 if (expect.equalsIgnoreCase("=")) { 569 lookahead = nextToken(); 570 } else { 571 throw ioException( 572 "Configuration.Error.Line.line.expected.expect.", 573 linenum, expect, st.sval); 574 } 575 break; 576 577 default: 578 throw ioException( 579 "Configuration.Error.Line.line.expected.expect.found.value.", 580 linenum, expect, st.sval); 581 } 582 return value; 583 } 584 585 private boolean peek(String expect) { 586 switch (lookahead) { 587 case ',': 588 return expect.equalsIgnoreCase(","); 589 case ';': 590 return expect.equalsIgnoreCase(";"); 591 case '{': 592 return expect.equalsIgnoreCase("{"); 593 case '}': 594 return expect.equalsIgnoreCase("}"); 595 default: 596 return false; 597 } 598 } 599 600 private int nextToken() throws IOException { 601 int tok; 602 while ((tok = st.nextToken()) == StreamTokenizer.TT_EOL) { 603 linenum++; 604 } 605 return tok; 606 } 607 608 private InputStream getInputStream(URL url) throws IOException { 609 if ("file".equalsIgnoreCase(url.getProtocol())) { 610 // Compatibility notes: 611 // 612 // Code changed from 613 // String path = url.getFile().replace('/', File.separatorChar); 614 // return new FileInputStream(path); 615 // 616 // The original implementation would search for "/tmp/a%20b" 617 // when url is "file:///tmp/a%20b". This is incorrect. The 618 // current codes fix this bug and searches for "/tmp/a b". 619 // For compatibility reasons, when the file "/tmp/a b" does 620 // not exist, the file named "/tmp/a%20b" will be tried. 621 // 622 // This also means that if both file exists, the behavior of 623 // this method is changed, and the current codes choose the 624 // correct one. 625 try { 626 return url.openStream(); 627 } catch (Exception e) { 628 String file = url.getPath(); 629 if (!url.getHost().isEmpty()) { // For Windows UNC 630 file = "//" + url.getHost() + file; 631 } 632 if (debugConfig != null) { 633 debugConfig.println("cannot read " + url + 634 ", try " + file); 635 } 636 return new FileInputStream(file); 637 } 638 } else { 639 return url.openStream(); 640 } 641 } 642 643 private String expand(String value) 644 throws PropertyExpander.ExpandException, IOException { 645 646 if (value.isEmpty()) { 647 return value; 648 } 649 650 if (!expandProp) { 651 return value; 652 } 653 String s = PropertyExpander.expand(value); 654 if (s == null || s.isEmpty()) { 655 throw ioException( 656 "Configuration.Error.Line.line.system.property.value.expanded.to.empty.value", 657 linenum, value); 658 } 659 return s; 660 } 661 662 private IOException ioException(String resourceKey, Object... args) { 663 MessageFormat form = new MessageFormat( 664 ResourcesMgr.getAuthResourceString(resourceKey)); 665 return new IOException(form.format(args)); 666 } 667 } 668 }